Every CVE Search/ Get API key

CVE-2019-12854

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated...

7.5 HighFix available

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

11.7%Up 9.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
CVE-2019-12854
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
CVE-2019-12854
Updated
2026-11-02
EUVDEUVD-2019-4434 No score

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
EUVD-2019-4434
Updated
2026-11-03
GitHub AdvisoriesGHSA-pxgg-fcwc-pc9f 7.5

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated...

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
GHSA-pxgg-fcwc-pc9f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 7.5

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
CVE-2019-12854
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-12854 7.5

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

Record
DEBIAN-CVE-2019-12854
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2020:4743 8.5

Red Hat Security Advisory: squid:4 security, bug fix, and enhancement update

Record
RHSA-2020:4743
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2020:4743 8.5

Moderate: squid:4 security, bug fix, and enhancement update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

  • squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

  • squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

  • squid: Improper input validation in URI processor (CVE-2019-12523)

  • squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

  • squid: Heap overflow issue in URN processing (CVE-2019-12526)

  • squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

  • squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

  • squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

  • squid: Buffer overflow in URI processor (CVE-2019-18676)

  • squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

  • squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

  • squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

  • squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

  • squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

  • squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  • squid: DoS in TLS handshake (CVE-2020-14058)

  • squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

  • squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Record
RLSA-2020:4743
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:4743 No score

Moderate: squid:4 security, bug fix, and enhancement update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

  • squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

  • squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

  • squid: Improper input validation in URI processor (CVE-2019-12523)

  • squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

  • squid: Heap overflow issue in URN processing (CVE-2019-12526)

  • squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

  • squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

  • squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

  • squid: Buffer overflow in URI processor (CVE-2019-18676)

  • squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

  • squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

  • squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

  • squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

  • squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

  • squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  • squid: DoS in TLS handshake (CVE-2020-14058)

  • squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

  • squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4743
Updated
2026-11-02
OSVMGASA-2019-0266 No score

Updated squid packages fix security vulnerabilities

Updated squid packages fix security vulnerabilities:

It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12525).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2019-12527).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12529).

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it (CVE-2019-12854).

It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks (CVE-2019-13345).

The squid package has been updated to version 4.8, fixing these issues and other bugs.

Record
MGASA-2019-0266
Updated
2026-11-02
OSVopenSUSE-SU-2019:2540-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2540-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2541-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2541-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2019:2975-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues
Record
SUSE-SU-2019:2975-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libecap
AlmaLinux:8
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
libecap-devel
AlmaLinux:8
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
squid
Debian:12
 before 4.8-1
4.8-1
squid
Debian:13
 before 4.8-1
4.8-1
squid
Debian:14
 before 4.8-1
4.8-1
squid
Debian:10
 before 4.6-1+deb10u1, plus listed versions
4.6-1
4.6-1+deb10u1
squid
Mageia:7
 before 4.8-1.mga7
4.8-1.mga7
libecap
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
Show 10 moreShow less
Affected packages
PackageAffectedFixed
libecap-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:enterprise_linux:8::appstream
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
squid-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
squid-debugsource
Red Hat:enterprise_linux:8::appstream
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
libecap
Rocky Linux:8
 before 0:1.0.1-2.module+el8.4.0+404+316a0dc5
0:1.0.1-2.module+el8.4.0+404+316a0dc5
squid
SUSE:Linux Enterprise Module for Server Applications 15
 before 4.9-5.11.1
4.9-5.11.1
squid
SUSE:Linux Enterprise Module for Server Applications 15 SP1
 before 4.9-5.11.1
4.9-5.11.1
squid
openSUSE:Leap 15.0
 before 4.9-lp150.13.1
4.9-lp150.13.1
squid
openSUSE:Leap 15.1
 before 4.9-lp151.2.7.1
4.9-lp151.2.7.1
squid
openSUSE:Tumbleweed
 before 4.16-1.5
4.16-1.5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-12854 is a high vulnerability (CVSS 7.5) in Squid-cache Squid, published August 15, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.7%, the 96th percentile. Fixed in libecap 1.0.1-2.module_el8.6.0+2741+01592ae8.

References

Show 175 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open